# Help, I've got a browser hijacker! **URL:** \ **Category:** Factual Questions\ **Created:** [January 25, 2004, 10:24pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048 "2004-01-25T22:24:46Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Hey\_It\_s\_That\_Guy](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@Hey\_It\_s\_That\_Guy](https://boards.straightdope.com/u/Hey_It_s_That_Guy)\ **Post date:** [January 25, 2004, 10:24pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/1 "2004-01-25T22:24:46Z")
Hello all, I have a new recurring computer problem, where every time I type in a URL, it automatically takes me to a page with a shady-looking search engine. It also resets my home page from Hotmail to this unwanted search engine, even after I go to Settings-Control Panel-Internet Options, and reenter [www.hotmail.com](http://www.hotmail.com) as my home page. I Googled a bit, and downloaded a program called Hijack This!, which I run, and then it gives me a list of all running processes. I check all the suspicious-looking ones to delete them, but this problem keeps coming back. Norton Antivirus, Adaware, and Spybot are no help, and this is incredibly frustrating. What can I do to get rid of this browser hijacker once and for all, and to stay safe in the future? Has anyone else used Hijack This!, and am I even using it properly? AAARRRGGGHHH! ---
**Author:** ![Hey\_It\_s\_That\_Guy](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@Hey\_It\_s\_That\_Guy](https://boards.straightdope.com/u/Hey_It_s_That_Guy)\ **Post date:** [January 25, 2004, 10:28pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/2 "2004-01-25T22:28:37Z")
If it makes a difference, I use Internet Explorer and dial up through AOL. Help me, someone! Please! ---
**Author:** ![Epileptik](https://avatars.discourse-cdn.com/v4/letter/e/f1d935/32.png) [@Epileptik](https://boards.straightdope.com/u/Epileptik)\ **Post date:** [January 25, 2004, 10:31pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/3 "2004-01-25T22:31:28Z")
Spyblaster might be worth a try. ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [January 25, 2004, 10:46pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/4 "2004-01-25T22:46:30Z")
Download and run [Ad-aware](http://fileforum.betanews.com/detail.php3?fid=965718306) ---
**Author:** ![Zigarre](https://avatars.discourse-cdn.com/v4/letter/z/bbce88/32.png) [@Zigarre](https://boards.straightdope.com/u/Zigarre)\ **Post date:** [January 25, 2004, 10:48pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/5 "2004-01-25T22:48:51Z")
What is the name on the search engine that opens when you enter the new URL? What page does it reselect as your home page? Using either name, you may be able to run a system search then search your registry for the thing. If you can’t find anything, post the URL’s it redirects you to, as that might lead to an answer. ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [January 25, 2004, 10:49pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/6 "2004-01-25T22:49:56Z")
Oops.are you certain you’ve aplied the updates to ad-aware? ---
**Author:** ![Hey\_It\_s\_That\_Guy](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@Hey\_It\_s\_That\_Guy](https://boards.straightdope.com/u/Hey_It_s_That_Guy)\ **Post date:** [January 25, 2004, 10:59pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/7 "2004-01-25T22:59:35Z")
> [@Zigarre](#): > > What is the name on the search engine that opens when you enter the new URL? What page does it reselect as your home page? > Using either name, you may be able to run a system search then search your registry for the thing. > If you can’t find anything, post the URL’s it redirects you to, as that might lead to an answer. The site it usually sends me to is: [http://www](http://www). smart-finder .biz **DO NOT CLICK ON IT, or any of the below links!** What happens is I’ll type in a URL like [http://www.amazon.com](http://www.amazon.com) and press Enter, then it’ll start taking me to “[http://www.nkvd.us/1507/www.amazon.com](http://www.nkvd.us/1507/www.amazon.com)”. And it comes up as the shady search engine I referred to above. So unless I have a website bookmarked, this problem essentially keeps me from going to other sites I want to go to! I’m pretty computer-literate, **Zigarre** , but I always worry about poking around and deleting things in my registry. **Epileptik** , I downloaded Spyware Blaster to go with Adaware and Spybot, and **Daizy** , I just updated Adaware and I’m running it again. Using Hijack This! seems to have made the problem go away for now, perhaps in concert with the others, but it has continued to come back over the last few days. Thank you all for your advice, and I’ll be hoping this is the last I see of the problem. But if anyone else has experience, feel free to chime in! ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [January 25, 2004, 11:16pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/8 "2004-01-25T23:16:58Z")
I hope you have indeed rid yourself of it. Should it decided to grace you with a return: Do a search for: mtwirl32.dll If you find it … Go to start then Run and then type regedit. Press enter. Navigate to: HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Higjlight ShellServiceObjectDelayLoad in the left pane. Look in the right pane for this entry: DDE Control Module Right click on it and choose delete. Click OK. Close the registry. RESTART THE COMPUTER Delete these files: C:\WINDOWS\SYSTEM\mtwirl32.dll mtwcnl32.dll ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [January 25, 2004, 11:36pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/9 "2004-01-25T23:36:01Z")
And finally…an [uninstaller](http://www.smart-finder.biz/uninstall.htm) ---
**Author:** ![Hey\_It\_s\_That\_Guy](https://avatars.discourse-cdn.com/v4/letter/h/6f9a4e/32.png) [@Hey\_It\_s\_That\_Guy](https://boards.straightdope.com/u/Hey_It_s_That_Guy)\ **Post date:** [January 25, 2004, 11:57pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/10 "2004-01-25T23:57:41Z")
Thank you again, **Daizy**! I couldn’t find “DDE Control Module” in my Registry, but I did find the files C:\WINDOWS\SYSTEM\mtwirl32.dll and mtwcnl32.dll and deleted them both. So far, so good! ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [January 26, 2004, 12:07am UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/11 "2004-01-26T00:07:28Z")
You’re most welcome **Big Bad Voodoo Lou**. Hope it works out for you. ---
**Author:** ![Zigarre](https://avatars.discourse-cdn.com/v4/letter/z/bbce88/32.png) [@Zigarre](https://boards.straightdope.com/u/Zigarre)\ **Post date:** [January 26, 2004, 1:13am UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/12 "2004-01-26T01:13:54Z")
Daizy What is the source of the mtwcnl32.dll file? What program loaded it, do you know? Good catch… Thanks ---
**Author:** ![kniz](https://avatars.discourse-cdn.com/v4/letter/k/c37758/32.png) [@kniz](https://boards.straightdope.com/u/kniz)\ **Post date:** [January 26, 2004, 1:31am UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/13 "2004-01-26T01:31:41Z")
I had the same thing happen to me, except the search engine was called “[search-space.com](http://search-space.com)”. I asked for help here on SDMB and what worked for me was getting rid of Explorer and going to Mozilla Firebird. I would use Hijackthis to find the bad file and delete it and the next thing I knew it was back. I really like Firebird, so this story has a happy ending. 😃 ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [January 26, 2004, 1:50am UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/14 "2004-01-26T01:50:03Z")
Hi **zigarre**. It’s a type of trojan. I’ll let [Symantec](http://securityresponse.symantec.com/avcenter/venc/data/trojan.bookmarker.c.html) explain it…as I’m sure I’d just muddy the waters for ya. 😉 ---
**Author:** ![conczepts](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@conczepts](https://boards.straightdope.com/u/conczepts)\ **Post date:** [January 26, 2004, 1:51am UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/15 "2004-01-26T01:51:55Z")
Search for a program called “cwshredder”, it is small and fixes the problem with maybe 3 clicks of the mouse. If it ever happens again (you get it from popups) just run cwshredder again, and then reset your homepage in start\>settings\>internet options. ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [January 26, 2004, 1:54am UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/16 "2004-01-26T01:54:01Z")
Hi **kniz** Glad you found a solution to your problem. Should anyone else run into that particular one, [CWShredder](http://www.pchell.com/support/searchspace.shtml) would have rid you of it. ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [January 26, 2004, 1:55am UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/17 "2004-01-26T01:55:46Z")
Oops **conczepts**. It appears we were typing at the same time. 🙂 Sorry about that. ---
**Author:** ![conczepts](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@conczepts](https://boards.straightdope.com/u/conczepts)\ **Post date:** [January 26, 2004, 2:34am UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/18 "2004-01-26T02:34:19Z")
Why, you…!!! Just kidding. 🙂 ---
**Author:** ![Madawc](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@Madawc](https://boards.straightdope.com/u/Madawc)\ **Post date:** [January 26, 2004, 4:27am UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/19 "2004-01-26T04:27:49Z")
I had the same problem with another hijack site. [cool-search.net](http://cool-search.net) (didn’t add the www’s so it won’t be a link) I used all the tools listed in this thread and it didn’t go the F_ck away. It always resetted to that F_cking damned site as my homepage. I was going F\*cking MAD. This [site](http://www.greenfieldgerbil.com/~matt979/archives/002427.html) helped me and now I don’t get that f\*cking site as my homepage. I just added this extra bit for other people in need of help and that might have this problem as well. ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [January 26, 2004, 12:56pm UTC](https://boards.straightdope.com/t/help-ive-got-a-browser-hijacker/226048/20 "2004-01-26T12:56:24Z")
I’m not sure what went wrong for you, **Madawc**. But CWShredder should have rid you of that one. Glad you were able to find your own solution though.